Use after free in Compositing in Google Chrome prior to 149

CVE-2026-11125 is a CWE-416 use-after-free in Chrome's Compositing pipeline affecting Google Chrome before 149.0.7827.53 on Linux and 149.0.7827.53/54 on Windows and macOS. The trigger is a crafted HTML page, so the attacker can deliver it over the web with no auth, but successful code execution lands inside the renderer sandbox rather than as native code on the host.

The vendor/CISA-ADP 8.8 HIGH score is directionally understandable for *network-reachable memory corruption*, but it overstates enterprise impact because the most important real-world fact is right in the description: execution is inside a sandbox. That means this is usually a first-stage browser foothold that still needs user interaction and often a second bug for host compromise, so for patch-priority purposes this behaves more like a solid MEDIUM than an emergency-wide endpoint crisis.

Why this verdict

• Downgrade for sandbox confinement: the advisory says code execution is *inside a sandbox*, which cuts the immediate outcome from host takeover to renderer compromise unless the attacker can chain another bug.
• Downgrade for user interaction: UI:R means this is not wormable and not passively reachable like an exposed appliance bug; it needs the victim to hit attacker-controlled content.
• Downgrade for lack of field pressure: no KEV listing, no public PoC found, and a very low EPSS all push this out of the emergency lane.
• Upgrade from LOW because Chrome is everywhere: browser bugs hit a massive installed base, and a renderer foothold can still expose session data and become the first leg of a chain.
• Upgrade from LOW because this is real memory corruption: use-after-free in a reachable browser component is not cosmetic; it is exploitable in principle and belongs in your normal browser patch program, not in backlog purgatory.

Why not higher?

Because the bug does not by itself deliver unsandboxed endpoint code execution in the available evidence. The attacker needs a user to browse malicious content and then usually needs a second stage to escape the renderer, which compounds friction fast in real enterprises.

Why not lower?

Because Chrome is one of the widest client-side attack surfaces you run, and a renderer compromise is still operationally meaningful. Even inside the sandbox, a browser foothold can target active sessions, web data, and chained exploitation opportunities, so treating it as mere hygiene would undershoot the risk.

1. Enforce browser version compliance — Use UEM/EDR/package management to flag and quarantine endpoints below 149.0.7827.53 where feasible. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but in practice browser drift should be corrected much faster because version inventory is easy.
2. Block unmanaged Chrome channels — Restrict portable, user-installed, or unmanaged Chrome variants that can evade enterprise update policy. Do this during the normal remediation cycle so patched builds actually land before the remediation deadline.
3. Harden risky browsing paths — Apply Safe Browsing, secure web gateway filtering, attachment detonation, and browser isolation for high-risk user groups. These controls reduce malicious-page delivery while you work through standard browser remediation; for MEDIUM, there is no separate noisgate mitigation clock.
4. Watch for crash clusters — Hunt for spikes in Chrome tab crashes, renderer restarts, and suspicious browsing destinations around high-value users. This is not a perfect detector, but it is the best practical early-warning signal for exploit development against fresh browser memory bugs.

Run this on the target endpoint or through your remote execution/UEM agent. Invoke it with python3 check_chrome_cve_2026_11125.py on macOS/Linux or py check_chrome_cve_2026_11125.py on Windows; no admin rights are required unless your tooling blocks reading standard install paths.

#!/usr/bin/env python3
# check_chrome_cve_2026_11125.py
# Determine whether the local Google Chrome install is vulnerable to CVE-2026-11125.
# Outputs exactly one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys
from shutil import which

TARGET = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_version(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def get_version_linux():
    candidates = [
        'google-chrome',
        'google-chrome-stable',
        'google-chrome-beta',
        'google-chrome-unstable',
        'chromium-browser',
        'chromium',
    ]
    for c in candidates:
        path = which(c)
        if path:
            out = run_cmd([path, '--version'])
            v = parse_version(out)
            if v:
                return v, path
    return None, None


def get_version_macos():
    app_paths = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        '/Applications/Google Chrome Beta.app/Contents/MacOS/Google Chrome Beta',
        '/Applications/Google Chrome Dev.app/Contents/MacOS/Google Chrome Dev',
        '/Applications/Chromium.app/Contents/MacOS/Chromium',
    ]
    for path in app_paths:
        if os.path.exists(path):
            out = run_cmd([path, '--version'])
            v = parse_version(out)
            if v:
                return v, path
    return None, None


def get_version_windows():
    paths = [
        os.path.join(os.environ.get('ProgramFiles', r'C:\Program Files'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('ProgramFiles(x86)', r'C:\Program Files (x86)'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('LOCALAPPDATA', ''), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('ProgramFiles', r'C:\Program Files'), 'Chromium', 'Application', 'chrome.exe'),
    ]
    for path in paths:
        if path and os.path.exists(path):
            out = run_cmd([path, '--version'])
            v = parse_version(out)
            if v:
                return v, path
    return None, None


def main():
    system = platform.system().lower()
    version = None
    source = None

    if 'linux' in system:
        version, source = get_version_linux()
    elif 'darwin' in system:
        version, source = get_version_macos()
    elif 'windows' in system:
        version, source = get_version_windows()
    else:
        print('UNKNOWN')
        sys.exit(2)

    if not version:
        print('UNKNOWN')
        sys.exit(2)

    # Chrome advisory says fixed at 149.0.7827.53 (Linux) and 149.0.7827.53/54 (Windows/Mac).
    # Treat any build >= 149.0.7827.53 as patched for this CVE.
    if cmp_version(version, TARGET) >= 0:
        print('PATCHED')
        sys.exit(0)
    else:
        print('VULNERABLE')
        sys.exit(1)


if __name__ == '__main__':
    main()

Sources

1. NVD CVE-2026-11125
2. Google Chrome Stable Channel Update for Desktop (June 2026)
3. Chromium issue 501517520
4. Chromium Multi-process Architecture
5. Chromium GPU Accelerated Compositing in Chrome
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS overview
8. FIRST EPSS data statistics